@anywalletkit/protocol-swap2-core 0.6.1 → 0.8.0

package/dist/swap2/base.d.cts

@@ -79,6 +79,12 @@ interface Swap2EngineConfig extends Swap2ProtocolConfig {
      * SOL juggling, priority fees. Default 20 000 000 lamports (0.02 SOL).
      */
     serializedNativeAllowance?: bigint | number | string;
+    /**
+     * The most nanoTON a TON cell-body deposit may attach as gas: on top of the input for a native source, the whole
+     * attached value for a jetton source (default 1 TON; live Omniston swaps attach 0.1–0.4). A build attaching more is
+     * refused (scan 2026-10-27 modules, F7).
+     */
+    tonGasCeiling?: bigint | number | string;
     /**
      * Review gate: called once the live quote is built and every payload/value
      * check has passed, BEFORE any approval or signature. It receives a copy of
@@ -100,6 +106,17 @@ interface Swap2EngineConfig extends Swap2ProtocolConfig {
      */
     allowUnlistedTokens?: boolean;
 }
+/** What a TON cell body does, as the engine read it before signing (scan 2026-10-27 modules, F13): its op, and the jetton transfer it is. */
+interface TonBodySummary {
+    op: number | null;
+    /** TEP-74 transfer from the account's own jetton wallet: amount, where it goes, where the excess returns, the TON forwarded. */
+    jettonTransfer?: {
+        amount: bigint;
+        destination: string | null;
+        responseDestination: string | null;
+        forwardTon: bigint;
+    };
+}
 /** What `swap2()` is about to sign, handed to {@link Swap2EngineConfig.reviewExecution}. */
 interface Swap2ExecutionPlan {
     provider: string;
@@ -138,6 +155,7 @@ interface Swap2ExecutionPlan {
         memo?: string;
         memoEncoding?: "utf8" | "hex";
         cellBody?: boolean;
+        cellBodyDecoded?: TonBodySummary;
     } | {
         kind: "token-transfer";
         token: string;
@@ -290,4 +308,4 @@ declare abstract class BaseSwap2Protocol extends Swap2Protocol {
     getSupportedTokens(options?: Swap2SupportedTokensOptions): Promise<Swap2SupportedToken[]>;
 }
 
-export { BaseSwap2Protocol, NATIVE_DECIMALS, SWAP2_CHAIN_ALIASES, SWAP2_ID_PREFIX, type SerializedExecutionExpectation, type Swap2Account, type Swap2EngineConfig, type Swap2ExecutionPhase, type Swap2ExecutionPhaseDetail, type Swap2ExecutionPlan, nativeDecimals, nativeUnits, normalizeTypedDomain, swap2ChainId };
+export { BaseSwap2Protocol, NATIVE_DECIMALS, SWAP2_CHAIN_ALIASES, SWAP2_ID_PREFIX, type SerializedExecutionExpectation, type Swap2Account, type Swap2EngineConfig, type Swap2ExecutionPhase, type Swap2ExecutionPhaseDetail, type Swap2ExecutionPlan, type TonBodySummary, nativeDecimals, nativeUnits, normalizeTypedDomain, swap2ChainId };

package/dist/swap2/base.d.ts

@@ -79,6 +79,12 @@ interface Swap2EngineConfig extends Swap2ProtocolConfig {
      * SOL juggling, priority fees. Default 20 000 000 lamports (0.02 SOL).
      */
     serializedNativeAllowance?: bigint | number | string;
+    /**
+     * The most nanoTON a TON cell-body deposit may attach as gas: on top of the input for a native source, the whole
+     * attached value for a jetton source (default 1 TON; live Omniston swaps attach 0.1–0.4). A build attaching more is
+     * refused (scan 2026-10-27 modules, F7).
+     */
+    tonGasCeiling?: bigint | number | string;
     /**
      * Review gate: called once the live quote is built and every payload/value
      * check has passed, BEFORE any approval or signature. It receives a copy of
@@ -100,6 +106,17 @@ interface Swap2EngineConfig extends Swap2ProtocolConfig {
      */
     allowUnlistedTokens?: boolean;
 }
+/** What a TON cell body does, as the engine read it before signing (scan 2026-10-27 modules, F13): its op, and the jetton transfer it is. */
+interface TonBodySummary {
+    op: number | null;
+    /** TEP-74 transfer from the account's own jetton wallet: amount, where it goes, where the excess returns, the TON forwarded. */
+    jettonTransfer?: {
+        amount: bigint;
+        destination: string | null;
+        responseDestination: string | null;
+        forwardTon: bigint;
+    };
+}
 /** What `swap2()` is about to sign, handed to {@link Swap2EngineConfig.reviewExecution}. */
 interface Swap2ExecutionPlan {
     provider: string;
@@ -138,6 +155,7 @@ interface Swap2ExecutionPlan {
         memo?: string;
         memoEncoding?: "utf8" | "hex";
         cellBody?: boolean;
+        cellBodyDecoded?: TonBodySummary;
     } | {
         kind: "token-transfer";
         token: string;
@@ -290,4 +308,4 @@ declare abstract class BaseSwap2Protocol extends Swap2Protocol {
     getSupportedTokens(options?: Swap2SupportedTokensOptions): Promise<Swap2SupportedToken[]>;
 }
 
-export { BaseSwap2Protocol, NATIVE_DECIMALS, SWAP2_CHAIN_ALIASES, SWAP2_ID_PREFIX, type SerializedExecutionExpectation, type Swap2Account, type Swap2EngineConfig, type Swap2ExecutionPhase, type Swap2ExecutionPhaseDetail, type Swap2ExecutionPlan, nativeDecimals, nativeUnits, normalizeTypedDomain, swap2ChainId };
+export { BaseSwap2Protocol, NATIVE_DECIMALS, SWAP2_CHAIN_ALIASES, SWAP2_ID_PREFIX, type SerializedExecutionExpectation, type Swap2Account, type Swap2EngineConfig, type Swap2ExecutionPhase, type Swap2ExecutionPhaseDetail, type Swap2ExecutionPlan, type TonBodySummary, nativeDecimals, nativeUnits, normalizeTypedDomain, swap2ChainId };

package/dist/swap2/base.js

@@ -7,8 +7,9 @@ import {
   nativeUnits,
   normalizeTypedDomain,
   swap2ChainId
-} from "../chunk-IGTMUTNJ.js";
+} from "../chunk-CRCDWV3L.js";
 import "../chunk-IVR3SREQ.js";
+import "../chunk-2KC734UX.js";
 export {
   BaseSwap2Protocol,
   NATIVE_DECIMALS,

package/dist/swap2/single.cjs

@@ -28,7 +28,58 @@ module.exports = __toCommonJS(single_exports);
 var import_core = require("@anywalletkit/core");
 var import_viem = require("viem");
 var import_tx_preview_evm = require("@anywalletkit/tx-preview-evm");
+var import_swap2_assets2 = require("@anywalletkit/swap2-assets");
+
+// src/util.ts
 var import_swap2_assets = require("@anywalletkit/swap2-assets");
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function base64Bytes(text) {
+  const s = text.replace(/-/g, "+").replace(/_/g, "/").replace(/=+$/, "");
+  if (!/^[A-Za-z0-9+/]*$/.test(s) || s.length % 4 === 1) return null;
+  const out = new Uint8Array(Math.floor(s.length * 3 / 4));
+  let bits = 0, acc = 0, n = 0;
+  for (const ch of s) {
+    acc = acc << 6 | B64.indexOf(ch);
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[n++] = acc >> bits & 255;
+    }
+  }
+  return out.subarray(0, n);
+}
+function crc16(bytes) {
+  let crc = 0;
+  for (const b of bytes) {
+    crc ^= b << 8;
+    for (let i = 0; i < 8; i++) crc = crc & 32768 ? (crc << 1 ^ 4129) & 65535 : crc << 1 & 65535;
+  }
+  return crc;
+}
+function tonRawAddress(address) {
+  if (address && typeof address === "object") {
+    const o = address;
+    if (typeof o.toRawString === "function") {
+      try {
+        return tonRawAddress(o.toRawString());
+      } catch {
+        return null;
+      }
+    }
+    if (typeof o.workChain === "number" && o.hash instanceof Uint8Array && o.hash.length === 32) {
+      return `${o.workChain}:${Array.from(o.hash, (b) => b.toString(16).padStart(2, "0")).join("")}`;
+    }
+    return null;
+  }
+  if (typeof address !== "string") return null;
+  const raw = /^(-?[0-9]{1,3}):([0-9a-fA-F]{64})$/.exec(address.trim());
+  if (raw) return `${Number(raw[1])}:${raw[2].toLowerCase()}`;
+  if (!/^[A-Za-z0-9+/_-]{48}$/.test(address.trim())) return null;
+  const bytes = base64Bytes(address.trim());
+  if (!bytes || bytes.length !== 36 || crc16(bytes.subarray(0, 34)) !== (bytes[34] << 8 | bytes[35])) return null;
+  const wc = bytes[1] === 255 ? -1 : bytes[1];
+  return `${wc}:${Array.from(bytes.subarray(2, 34), (b) => b.toString(16).padStart(2, "0")).join("")}`;
+}
 
 // src/errors.ts
 var Swap2Error = class extends Error {
@@ -196,7 +247,64 @@ function normalizeTypedDomain(domain) {
   else if (typeof raw === "string" && /^0x[0-9a-fA-F]+$/.test(raw)) chainId = safeChainId(BigInt(raw));
   return chainId === void 0 || !Number.isSafeInteger(chainId) ? domain : { ...domain, chainId };
 }
+function assertTypedOrder(typedData, approvalAddress, e) {
+  const fail = (why) => new Swap2ValidationError(`swap2: typed order refused \u2014 ${why}`);
+  let parsed;
+  try {
+    parsed = JSON.parse(typedData);
+  } catch {
+    throw fail("the typed data is not JSON");
+  }
+  if (!parsed || typeof parsed !== "object") throw fail("the typed data is not an object");
+  const td = parsed;
+  const primary = td.primaryType;
+  if (typeof primary !== "string" || !primary) throw fail("it names no primaryType");
+  if (/^permit/i.test(primary)) throw fail(`${primary} is a token approval, not an order`);
+  if (primary !== "Order") throw fail(`primaryType ${primary} is not an order this engine signs`);
+  const fields = td.types?.Order;
+  const has = (name, type) => Array.isArray(fields) && fields.some((f) => f?.name === name && f?.type === type);
+  if (!has("maker", "address") || !has("makerAsset", "address") || !has("makingAmount", "uint256")) throw fail("the Order type has no maker / makerAsset / makingAmount");
+  const verifying = td.domain?.verifyingContract;
+  if (!approvalAddress || typeof verifying !== "string" || verifying.toLowerCase() !== approvalAddress.toLowerCase()) {
+    throw fail(`verifyingContract ${String(verifying)} is not the settlement contract the swap approves`);
+  }
+  if (e.chainId !== null && normalizeTypedDomain(td.domain)?.chainId !== e.chainId) throw fail("the domain chainId is not the source chain");
+  const m = td.message ?? {};
+  if (String(m.maker ?? "").toLowerCase() !== e.self.toLowerCase()) throw fail("the maker is not this account");
+  if (!e.token || String(m.makerAsset ?? "").toLowerCase() !== e.token.toLowerCase()) throw fail("the makerAsset is not the source token");
+  const raw = m.makingAmount;
+  const making = typeof raw === "string" && /^(?:0x[0-9a-fA-F]{1,64}|[0-9]{1,78})$/.test(raw) ? BigInt(raw) : typeof raw === "number" && Number.isSafeInteger(raw) ? BigInt(raw) : null;
+  if (making === null || making !== BigInt(e.amount)) throw fail(`makingAmount ${String(raw)} is not the swap's ${e.amount}`);
+}
 var DEFAULT_SERIALIZED_NATIVE_ALLOWANCE = 20000000n;
+var DEFAULT_TON_GAS_CEILING = 1000000000n;
+var JETTON_TRANSFER_OP = 260734629;
+function readTonBody(cell) {
+  let s;
+  try {
+    s = cell.beginParse();
+  } catch {
+    return { op: null };
+  }
+  let op;
+  try {
+    op = s.loadUint(32);
+  } catch {
+    return { op: null };
+  }
+  if (op !== JETTON_TRANSFER_OP) return { op };
+  try {
+    s.loadUintBig(64);
+    const amount = s.loadCoins();
+    const destination = tonRawAddress(s.loadAddress());
+    const response = s.loadMaybeAddress();
+    s.loadMaybeRef();
+    const forwardTon = s.loadCoins();
+    return { op, jettonTransfer: { amount, destination, responseDestination: response == null ? null : tonRawAddress(response), forwardTon } };
+  } catch {
+    return { op };
+  }
+}
 function reviewedIdentity(plan) {
   const { feeUsd: _fee, etaSeconds: _eta, validUntilMs: _valid, approvals: _approvals, destAmount: _dest, requoted: _requoted, ...pinned } = plan;
   return JSON.stringify(pinned, (_k, v) => typeof v === "bigint" ? v.toString() : v);
@@ -277,17 +385,17 @@ function nonEmptyRef(ref, side) {
 }
 function toSymbol(caip2, ref) {
   nonEmptyRef(ref, "source");
-  const byToken = ref.startsWith("0x") || ref.length > 20 ? (0, import_swap2_assets.ccAssetByToken)(caip2, ref) : void 0;
+  const byToken = ref.startsWith("0x") || ref.length > 20 ? (0, import_swap2_assets2.ccAssetByToken)(caip2, ref) : void 0;
   if (byToken) return byToken.symbol;
-  if ((0, import_swap2_assets.ccAsset)(caip2, ref)) return ref;
+  if ((0, import_swap2_assets2.ccAsset)(caip2, ref)) return ref;
   return ref;
 }
 function toDestAddress(caip2, ref, allowUnlisted = false) {
   nonEmptyRef(ref, "destination");
   if (ref.startsWith("0x")) return ref;
-  const asset = (0, import_swap2_assets.ccAssetByToken)(caip2, ref) ?? (0, import_swap2_assets.ccAsset)(caip2, ref);
+  const asset = (0, import_swap2_assets2.ccAssetByToken)(caip2, ref) ?? (0, import_swap2_assets2.ccAsset)(caip2, ref);
   if (!asset) {
-    if (allowUnlisted && (0, import_swap2_assets.isTokenAddress)(caip2, ref)) return ref;
+    if (allowUnlisted && (0, import_swap2_assets2.isTokenAddress)(caip2, ref)) return ref;
     throw new Error(`swap2: unknown destination token '${ref}' on ${caip2}`);
   }
   return asset.contract ?? ZERO;
@@ -416,7 +524,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   /** The source asset the options name: the catalog's, or (allowUnlistedTokens) an unlisted one with its decimals. */
   sourceAsset(options) {
     const decimals = options.fromTokenDecimals;
-    return (0, import_swap2_assets.resolveAsset)(this.fromChain, toSymbol(this.fromChain, options.fromToken), {
+    return (0, import_swap2_assets2.resolveAsset)(this.fromChain, toSymbol(this.fromChain, options.fromToken), {
       allowUnlisted: this.unlistedAllowed(),
       ...decimals !== void 0 ? { decimals } : {}
     });
@@ -430,7 +538,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   async prepareOptions(options) {
     if (!this.unlistedAllowed()) return options;
     const ref = toSymbol(this.fromChain, options.fromToken);
-    if ((0, import_swap2_assets.resolveAsset)(this.fromChain, ref) || !(0, import_swap2_assets.isTokenAddress)(this.fromChain, ref)) return options;
+    if ((0, import_swap2_assets2.resolveAsset)(this.fromChain, ref) || !(0, import_swap2_assets2.isTokenAddress)(this.fromChain, ref)) return options;
     const key = ref.startsWith("0x") ? ref.toLowerCase() : ref;
     let decimals = this.unlistedDecimals.get(key);
     if (decimals === void 0) {
@@ -461,8 +569,8 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     const source = this.sourceAsset(options);
     const params = {
       sourceChain: this.fromChain,
-      sourceToken: (0, import_swap2_assets.isUnlisted)(source) ? source.contract : toSymbol(this.fromChain, options.fromToken),
-      ...(0, import_swap2_assets.isUnlisted)(source) ? { sourceDecimals: source.decimals } : {},
+      sourceToken: (0, import_swap2_assets2.isUnlisted)(source) ? source.contract : toSymbol(this.fromChain, options.fromToken),
+      ...(0, import_swap2_assets2.isUnlisted)(source) ? { sourceDecimals: source.decimals } : {},
       destChain,
       destToken: toDestAddress(destChain, options.toToken, this.unlistedAllowed()),
       amountIn: amountIn.toString(),
@@ -656,12 +764,15 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
       }
     }
     const executionModels = [unsigned.data !== void 0, unsigned.bodyBoc !== void 0, unsigned.typedData !== void 0].filter(Boolean).length;
-    if (executionModels > 1 || unsigned.memo !== void 0 && (unsigned.bodyBoc !== void 0 || unsigned.typedData !== void 0)) {
+    if (executionModels > 1 || unsigned.memo !== void 0 && (unsigned.bodyBoc !== void 0 || unsigned.typedData !== void 0) || unsigned.orderExtension !== void 0 && unsigned.typedData === void 0) {
       throw new Error("swap2: provider returned ambiguous execution payloads");
     }
     if (unsigned.approvalAddress && !unsigned.data && !unsigned.typedData) {
       throw new Error("swap2: approval is only valid for calldata or typed-order execution");
     }
+    if (provider.remote === true && provider.depositAddressRoutes !== true && unsigned.data === void 0 && unsigned.bodyBoc === void 0 && unsigned.typedData === void 0 && !serialized) {
+      throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' sends the input to ${unsigned.to}, an address its backend named, and the app did not allow deposit-address routes for it (remoteProvider depositAddressRoutes) \u2014 refused`);
+    }
     const tronSource = this.fromChain.startsWith("tron:");
     const nearSource = this.fromChain.startsWith("near:");
     if (unsigned.memo && !this.fromChain.startsWith("ton:") && !tronSource && !nearSource) {
@@ -689,10 +800,12 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
       throw new Error(`swap2: provider transaction chain ${unsigned.chainId} does not match ${this.fromChain}`);
     }
     let tokenId;
+    let engineTransfer = false;
     if (!unsigned.data && !unsigned.bodyBoc && !unsigned.typedData && !serialized) {
       const src = this.sourceAsset(executionOptions);
       if (src?.contract) {
         if (this.fromChain.startsWith("eip155:")) {
+          engineTransfer = true;
           unsigned = {
             ...unsigned,
             to: src.contract,
@@ -731,12 +844,69 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     } else if (!unsigned.typedData && !unsigned.bodyBoc && executionValue !== BigInt(q.sourceAmount) + declaredNativeFee(q, this.fromChain)) {
       throw new Error("swap2: provider execution amount does not match the validated quote");
     }
+    let tonBody;
+    if (cellBody !== void 0) {
+      const refuse = (why) => {
+        throw new Swap2ValidationError(`swap2: TON cell-body build refused \u2014 ${why}`);
+      };
+      const raw = this._config.tonGasCeiling;
+      const ceiling = raw === void 0 ? DEFAULT_TON_GAS_CEILING : BigInt(raw);
+      if (ceiling < 0n) throw new Swap2ConfigurationError("swap2: tonGasCeiling must be non-negative");
+      if (provider.remote === true && provider.verifiesBuilds !== true) refuse("a remote provider's cell body needs the app's own validator (remoteProvider verifyBuild)");
+      tonBody = readTonBody(cellBody);
+      const input = BigInt(q.sourceAmount);
+      if (source.contract) {
+        if (executionValue > ceiling) refuse(`it attaches ${executionValue} nanoTON to a jetton transfer, more than the ${ceiling} gas ceiling`);
+        const t = tonBody.jettonTransfer;
+        if (!t) refuse("a jetton-source body must be a jetton transfer");
+        if (t.amount !== input) refuse(`the jetton transfer moves ${t.amount}, not the swap's ${input}`);
+        if (!t.responseDestination || t.responseDestination !== tonRawAddress(selfAddress)) refuse("the jetton transfer returns its excess to another wallet");
+        if (t.forwardTon >= executionValue) refuse("the jetton transfer forwards more TON than the message carries");
+        const own = typeof signer.getJettonWalletAddress === "function" ? tonRawAddress(await signer.getJettonWalletAddress(source.contract)) : null;
+        if (!own) refuse("the account cannot name its own jetton wallet (getJettonWalletAddress), so the target cannot be checked");
+        if (tonRawAddress(unsigned.to) !== own) refuse(`it is sent to ${unsigned.to}, not this account's ${source.symbol ?? "source"} jetton wallet`);
+      } else {
+        if (executionValue < input || executionValue - input > ceiling) refuse(`it attaches ${executionValue} nanoTON for a ${input} input, more than the ${ceiling} gas ceiling on top`);
+        const pinned = provider.remote === true ? [...provider.callTargets?.(this.fromChain) ?? [], ...q.depositAddress ? [q.depositAddress] : []].map(tonRawAddress).filter((a) => !!a) : [];
+        if (pinned.length && !pinned.includes(tonRawAddress(unsigned.to) ?? "")) refuse(`remote provider '${q.provider}' sends it to ${unsigned.to}, which the app did not pin (remoteProvider callTargets)`);
+      }
+    }
+    const remote = provider.remote === true;
+    const pins = (list) => (list ?? []).filter((a) => typeof a === "string" && /^0x[0-9a-fA-F]{40}$/.test(a)).map((a) => a.toLowerCase());
+    const pinnedTargets = remote ? pins(provider.callTargets?.(this.fromChain)) : [];
+    const pinnedSpenders = remote ? pins(provider.spenders?.(this.fromChain)) : [];
+    if (remote && unsigned.approvalAddress && !pinnedSpenders.includes(unsigned.approvalAddress.toLowerCase())) {
+      throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' asks to approve ${unsigned.approvalAddress} on ${this.fromChain}, which the app did not pin as a spender (remoteProvider spenders) \u2014 refused`);
+    }
+    if (unsigned.typedData !== void 0) {
+      if (remote && provider.verifiesBuilds !== true) {
+        throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' asks to sign a typed order, which needs the app's own validator (remoteProvider verifyBuild) \u2014 refused`);
+      }
+      const chainId = this.fromChain.startsWith("eip155:") ? Number(this.fromChain.slice("eip155:".length)) : null;
+      assertTypedOrder(unsigned.typedData, unsigned.approvalAddress, { self: selfAddress, token: source.contract ?? void 0, amount: q.sourceAmount, chainId });
+    }
     if (unsigned.data !== void 0 && this.fromChain.startsWith("eip155:")) {
       const call = (0, import_tx_preview_evm.decodeCall)({ to: unsigned.to, data: unsigned.data, value: executionValue });
-      const named = call.transfer?.to ?? call.approval?.spender;
-      const allowed = [selfAddress, q.depositAddress, unsigned.approvalAddress, unsigned.to].filter((a) => !!a).map((a) => a.toLowerCase());
-      if (named && !allowed.includes(named.toLowerCase())) {
-        throw new Swap2ValidationError(`swap2: quote calldata (${call.method}) names ${(0, import_viem.getAddress)(named)}, which is not this account, the deposit address or the declared spender \u2014 refused`);
+      if (call.undecodable) throw new Swap2ValidationError("swap2: quote calldata is not hex bytes \u2014 refused");
+      if (call.approval && call.approval.kind !== "erc20") {
+        throw new Swap2ValidationError(`swap2: quote calldata is ${call.approval.kind === "operator" ? "an operator approval (setApprovalForAll)" : "a Permit2 approval"} \u2014 never a swap's main call; refused`);
+      }
+      if (call.transfer || call.approval) {
+        if (!source.contract || unsigned.to.toLowerCase() !== source.contract.toLowerCase()) {
+          throw new Swap2ValidationError(`swap2: quote calldata (${call.method}) moves ${(0, import_viem.getAddress)(unsigned.to)}, not the source token \u2014 refused`);
+        }
+        if (call.method === "transferFrom") throw new Swap2ValidationError("swap2: quote calldata pulls the source token with transferFrom \u2014 refused");
+        const amount = call.transfer?.amount ?? call.approval?.amount ?? null;
+        if (amount === null || amount > BigInt(q.sourceAmount)) {
+          throw new Swap2ValidationError(`swap2: quote calldata (${call.method}) covers ${amount === null ? "an unlimited amount" : amount} of the source token, more than the swap's ${q.sourceAmount} \u2014 refused`);
+        }
+        const named = (call.transfer?.to ?? call.approval.spender).toLowerCase();
+        const allowed = engineTransfer ? [q.depositAddress] : remote ? [selfAddress, ...pinnedTargets, ...pinnedSpenders] : [selfAddress, q.depositAddress, unsigned.approvalAddress];
+        if (!allowed.filter((a) => !!a).map((a) => a.toLowerCase()).includes(named)) {
+          throw new Swap2ValidationError(`swap2: quote calldata (${call.method}) names ${(0, import_viem.getAddress)(named)}, which is not this account, the deposit address or ${remote ? "a spender the app pinned" : "the declared spender"} \u2014 refused`);
+        }
+      } else if (remote && !pinnedTargets.includes(unsigned.to.toLowerCase())) {
+        throw new Swap2ValidationError(`swap2: remote provider '${q.provider}' calls ${(0, import_viem.getAddress)(unsigned.to)} on ${this.fromChain}, which the app did not pin as a call target (remoteProvider callTargets) \u2014 refused`);
       }
     }
     const needsApproval = !!unsigned.approvalAddress && !!source.contract;
@@ -798,7 +968,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
           ...unsigned.chainId !== void 0 ? { chainId: unsigned.chainId } : {},
           ...unsigned.gasLimit ? { gasLimit: BigInt(unsigned.gasLimit) } : {},
           ...unsigned.memo ? { memo: unsigned.memo, ...unsigned.memoEncoding ? { memoEncoding: unsigned.memoEncoding } : {} } : {},
-          ...cellBody !== void 0 ? { cellBody: true } : {}
+          ...cellBody !== void 0 ? { cellBody: true, ...tonBody ? { cellBodyDecoded: tonBody } : {} } : {}
         }
       };
       const previous = carried?.reviewed;
@@ -1063,6 +1233,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
       throw new Swap2ValidationError(`swap2: claim target ${unsigned.to} is not a contract '${name}' declares for ${unsigned.chain} \u2014 refused`);
     }
     const claimCall = (0, import_tx_preview_evm.decodeCall)({ to: unsigned.to, data: unsigned.data, value: 0n });
+    if (claimCall.undecodable) throw new Swap2ValidationError("swap2: claim calldata is not hex bytes \u2014 refused");
     if (claimCall.transfer || claimCall.approval) {
       throw new Swap2ValidationError(`swap2: claim calldata (${claimCall.method}) moves tokens or grants an allowance \u2014 refused`);
     }
@@ -1123,7 +1294,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
   /** Source chains this protocol can swap from. */
   async getSupportedChains() {
     if (!this.protocolEnabled()) return [];
-    return import_swap2_assets.CC_SOURCE_CHAINS.filter((c) => this.chainSupported(c.caip2)).map((c) => ({
+    return import_swap2_assets2.CC_SOURCE_CHAINS.filter((c) => this.chainSupported(c.caip2)).map((c) => ({
       id: c.caip2,
       name: c.label,
       type: chainType(c.caip2),
@@ -1136,7 +1307,7 @@ var BaseSwap2Protocol = class extends import_core.Swap2Protocol {
     const wantTo = options?.toChain != null ? toCaip2(options.toChain, "") : void 0;
     if (!this.protocolEnabled() || wantFrom && wantTo && !this.pairSupported(wantFrom, wantTo)) return [];
     const out = [];
-    for (const c of import_swap2_assets.CC_SOURCE_CHAINS) {
+    for (const c of import_swap2_assets2.CC_SOURCE_CHAINS) {
       if (!this.chainSupported(c.caip2)) continue;
       if ((wantFrom || wantTo) && c.caip2 !== wantFrom && c.caip2 !== wantTo) continue;
       for (const a of c.assets) {
@@ -1207,6 +1378,24 @@ function validQuote(q, params, provider) {
     return false;
   }
 }
+function remotePinRefusal(provider, q, chain) {
+  if (provider.remote !== true) return null;
+  const tx = q.txRequest;
+  const plain = tx ? tx.data === void 0 && tx.serializedTx === void 0 : typeof q.depositAddress === "string" && q.depositAddress !== "";
+  if (plain && provider.depositAddressRoutes !== true) {
+    return `${provider.name}: the route pays ${tx?.to || q.depositAddress}, an address the backend named, and the app did not allow deposit-address routes for this provider (remoteProvider depositAddressRoutes)`;
+  }
+  if (!chain.startsWith("eip155:")) return null;
+  if (!tx || tx.serializedTx !== void 0) return null;
+  const pinned = (list, address) => (list ?? []).some((a) => typeof a === "string" && a.toLowerCase() === address.toLowerCase());
+  if (tx.approvalAddress && !pinned(provider.spenders?.(chain), tx.approvalAddress)) {
+    return `${provider.name}: the route approves ${tx.approvalAddress}, which the app did not pin as a spender on ${chain} (remoteProvider spenders)`;
+  }
+  if (tx.data !== void 0 && tx.to && !pinned(provider.callTargets?.(chain), tx.to)) {
+    return `${provider.name}: the route calls ${tx.to}, which the app did not pin as a call target on ${chain} (remoteProvider callTargets)`;
+  }
+  return null;
+}
 
 // src/swap2/single.ts
 var SingleProviderSwap2 = class extends BaseSwap2Protocol {
@@ -1234,6 +1423,11 @@ var SingleProviderSwap2 = class extends BaseSwap2Protocol {
         this.lastRefusal ||= `${name}: rejected by validation (minDest=${quote.minDestAmount} vs floor=${snapshot.minAmountOut ?? "-"})`;
         return null;
       }
+      const unpinned = remotePinRefusal(this.provider, quote, snapshot.sourceChain);
+      if (unpinned) {
+        this.lastRefusal ||= unpinned;
+        return null;
+      }
       return { ...quote, provider: name };
     } catch (err) {
       this.lastRefusal ||= `${name}: ${(err instanceof Error ? err.message : String(err)).slice(0, 160)}`;